# syntax=docker/dockerfile:1

# Trivy is a single static binary, so it can be copied into a slim base image.
ARG TRIVY_IMAGE=aquasec/trivy:latest
FROM ${TRIVY_IMAGE} AS trivy

FROM python:3.12-slim

LABEL org.opencontainers.image.title="docker-vuln-scan" \
      org.opencontainers.image.description="Trivy image vulnerability scanner with Apprise alerts" \
      org.opencontainers.image.licenses="MIT"

RUN apt-get update \
 && apt-get install -y --no-install-recommends ca-certificates \
 && rm -rf /var/lib/apt/lists/* \
 && pip install --no-cache-dir "apprise>=1.8,<2"

COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy
COPY scan.py /usr/local/bin/scan.py
RUN chmod 0755 /usr/local/bin/scan.py

ENV REPORT_DIR=/reports \
    TRIVY_CACHE_DIR=/var/lib/trivy \
    TRIVY_NO_PROGRESS=true \
    PYTHONUNBUFFERED=1

VOLUME ["/reports"]

ENTRYPOINT ["/usr/local/bin/scan.py"]